JNCDS-SEC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Availability formula

Availability equals MTBF divided by MTBF plus MTTR. Reducing mean time to repair through fast failover and spare parts raises availability more cheaply than improving device reliability.

Requirement traceability

Every design element maps back to a numbered customer requirement. Untraceable components are candidates for removal; untraceable requirements signal a gap in the design.

Oversubscription ratio

Aggregate downstream capacity divided by uplink capacity. A 20:1 access ratio means 20 Gbps of host ports share 1 Gbps of uplink, so busy-hour demand must stay below that.

Four nines downtime

99.99 percent availability allows roughly 52 minutes of downtime per year. Reaching it requires redundant devices, diverse paths, and sub-second failover, not just reliable hardware.

Design scope boundary

The explicit list of in-scope devices, out-of-scope legacy systems, demarcation points, and ownership between customer, carrier, and integrator. Ambiguity here causes most design disputes.

802.1X roles

The supplicant is the client, the authenticator is the switch or wireless controller, and the authentication server is RADIUS. EAP-TLS with certificates is the strongest method.

Dynamic ARP inspection

DAI validates ARP packets against the DHCP snooping binding table, dropping spoofed ARP replies. It prevents man-in-the-middle attacks within a Layer 2 VLAN.

uRPF strict versus loose

Strict unicast RPF drops packets whose source is not reachable via the receiving interface. Loose mode only checks the source exists in the routing table, suiting asymmetric paths.

MACsec versus IPsec

MACsec encrypts hop-by-hop at Layer 2 on a link. IPsec with IKEv2 encrypts end-to-end across untrusted transport. Use MACsec on trusted links, IPsec over the internet.

Control plane policing

CoPP classifies and rate-limits traffic destined to the router CPU, protecting routing protocols and management from DoS floods while allowing legitimate control traffic.

Microsegmentation

Policy enforcement between individual workloads or groups rather than only at the perimeter. It limits lateral movement after a compromise and is central to zero-trust data center design.

SNMPv3 authPriv

SNMPv3 with authentication and privacy encrypts both the credential check and the payload. It replaces SNMPv1 and v2c, which send community strings in clear text.

BFD

Bidirectional Forwarding Detection is a lightweight sub-second hello protocol that detects path failures faster than IGP timers, triggering rapid reconvergence or failover.

Streaming telemetry

A push model using gNMI or gRPC that sends device state at high frequency to collectors. It gives finer granularity than SNMP polling for congestion and queue analysis.

NTP stratum levels

Stratum 0 is the reference clock, stratum 1 servers attach directly, and internal servers are stratum 2 or higher. Synchronized time is required for log correlation and certificates.

HSRP tracking

Object tracking lowers a router's HSRP priority when a tracked interface or route fails, forcing standby takeover. Preempt must be enabled for the higher-priority router to reclaim.

Configuration drift

Divergence between the intended and running device configuration. It is controlled with infrastructure-as-code templates, automated backups, and post-change compliance checks.

Collapsed core design

Core and distribution functions combine into one layer for small and medium campuses, reducing cost and hops. It suits sites where policy boundaries are simple.

RSTP edge ports

PortFast ports skip listening and learning states for immediate host connectivity. BPDU Guard disables them if a switch is connected, preventing loops.

Root Guard

Root Guard on a downstream-facing port blocks superior BPDUs, keeping the intended distribution switch as spanning-tree root and preventing topology hijacking.

PoE budget

The total wattage a switch can supply across all ports, which is less than the per-port maximum. Sum device class draw and compare against budget before deployment.

Wireless coverage target

Design for at least -67 dBm RSSI for voice and -72 dBm for data at cell edges, with non-overlapping channels and adequate AP density for client count.

FlexConnect local switching

An access point mode that switches client traffic locally at the branch while keeping control plane to the controller, allowing WAN failure survivability.

SD-WAN overlay

IPsec tunnels built over mixed transports with centralized policy and per-application SLA steering. It lets internet broadband carry traffic previously reserved for MPLS.

QoS trust boundary

The point where markings from downstream devices are accepted. Mark and classify at the access edge, then trust at the WAN edge to preserve end-to-end treatment.

BGP max-prefix limit

A safeguard that resets a peering session when the received prefix count exceeds a configured threshold, protecting against route leaks and misconfiguration.

WAN headroom sizing

Size each site uplink to busy-hour demand plus 30 to 50 percent growth. If a backup link must carry full load during failover, size it for peak, not average.

Hub-and-spoke tradeoff

Spoke-to-spoke traffic traverses the hub, centralizing policy at the cost of added latency and hub bandwidth. Partial mesh or SD-WAN removes that hairpin for selected flows.

Spine-leaf topology

Every leaf connects to every spine, and spines never connect to each other. Equal-cost paths give predictable two-to-three hop latency between any two servers.

VXLAN VNI

A 24-bit identifier giving about 16 million segments. VXLAN encapsulates Layer 2 frames in UDP, letting Layer 2 stretch over a Layer 3 underlay.

EVPN control plane

BGP EVPN distributes MAC and IP reachability for VXLAN overlays, replacing flood-and-learn. It reduces unknown unicast flooding and supports multihoming.

Distributed anycast gateway

The same gateway IP and MAC configured on every leaf, so a migrated host keeps its default gateway without ARP changes. It is required for seamless VM mobility.